Hello @ryux1,
Thanks for clarifying that SSL could be problematic.
For that path, I’d avoid Worker handling, redirects, WAF challenges, cache rules, Always Use HTTPS redirects, or anything that changes the request before it reaches Vercel. If that path does not reach Vercel cleanly over HTTP, Vercel’s automatic certificate renewal can fail even if the rest of your site works through Cloudflare.
Unfortunately, I have to implement cache rules and a whitelist for all paths; otherwise, I expose Vercel to potential spam requests or cache-busting that could lead to a denial-of-service attack. However, I can configure the cache duration to a more sensible value, such as 5 minutes, for a specific path. But then the challenge must also be served under a static path, and, assuming your wildcard, this might not be the case.
On custom certificates: Vercel does support uploading custom SSL certificates, but the docs say that is an Enterprise feature. Vercel also does not automatically renew custom uploaded certificates. So unless you are on Enterprise, I would not expect there to be a supported way to make Vercel serve a Cloudflare Origin Certificate instead of Vercel’s automatically managed certificate.
I understand. Cloudflare is configured to terminate the origin connection and provide its own TLS connection. However, because Vercel is proxied behind Cloudflare, it appears unable to renew its certificate, and Cloudflare fails to connect to the origin due to an expired TLS certificate. Since Vercel controls TLS and renewals, I would need to know which path it expects to provide the challenge under. If that’s possible, I can dynamically whitelist this path for the challenge verification.
One important caveat: I would not rely on Vercel as a “thin tunnel” to work around platform limits. Even if Cloudflare caches the outer response, requests that miss cache or vary by headers/query/auth can still hit the Vercel Function, and putting another reverse proxy in front also makes domain validation and security behavior harder to reason about.
This makes sense, but Cloudflare has no limits to its CDN. I can cache unlimited requests before they ever reach Vercel. If I would not have Cloudflare in front of Vercel, I would, in fact, hit the monthly request limit in about an hour, which is why Cloudflare in front of it is unnegotiable.
If you want to test whether the ACME path is the blocker, I’d add a temporary route/static file under /.well-known/acme-challenge/test and confirm that Cloudflare serves the exact Vercel response with no Worker, redirect, cache mutation, or challenge applied.
Do requests to paths with /.well-known/acme-challenge/count towards any quote of Vercel? If not, I have also set up Vercel Firewall to whitelist requests from Cloudflare only to prevent someone from spoofing the DNS and using Vercel’s IPs to bypass the proxy. More here:
With this in mind, will challenge verification still continue to work?
